Directorate General of Public Finances

France's tax agency lost 678,000 records through logins it had issued itself

DGFiP says the intruder used a stolen employee identifier and an authorised third party's credentials, and claimed to bypass MFA. No zero-day was involved.